New research from CYFIRMA warned that deepfake technology has evolved from a reputational and disinformation concern into a material operational and financial risk for manufacturing supply chains. Recognizing that manufacturers face particular exposure because of distributed, multi-tier vendor networks, high-value payments, hybrid IT-OT environments and widespread reliance on voice and video communications among procurement, finance and engineering teams. Attackers can use synthetic audio and video to impersonate executives or suppliers, potentially redirect shipments, alter payment details or pressure employees into bypassing established controls.
The report also highlighted growing risk of synthetic identities being used to infiltrate manufacturing workforces, including through remote hiring processes.
CYFIRMA said North Korean-linked IT worker campaigns have targeted critical manufacturing and other sectors, with researchers observing a shift from static images to real-time deepfake video during job interviews. The firm said no single technology, including provenance standards, watermarking or AI detection tools, can currently close the gap on its own. Instead, manufacturers should rely on independent out-of-band verification, stronger payment and vendor-change controls, deepfake-aware hiring practices and greater scrutiny of high-stakes requests across procurement, finance and human resources.
This comes as the firm surveys four converging attack patterns-executive/vendor impersonation fraud, synthetic identity infiltration of the workforce, supply-chain-level disinformation and reconnaissance, and emerging risks to physical quality/provenance processes-and maps them to the manufacturing threat surface specifically. It also observes a defense framework organized around identity verification, payment-process hardening, workforce screening, and content provenance, referencing current U.S. government guidance and industry standards.
According to public reporting, global engineering firm Arup lost $25 million in January 2024 after attackers used AI-generated video and audio to impersonate senior executives during a live video call and persuade an employee to authorize the transfer. Fraud-detection firm Pindrop later reported a 1,210% increase in AI-driven fraud attacks during 2025, with figures supplied to trade press estimating $1 billion in combined losses among more than 50 major U.S. customers.
Meanwhile, North Korean state-linked operatives have expanded fraudulent remote-worker infiltration schemes beyond technology, critical manufacturing and transportation. A May 2024 U.S. Department of Justice case involving an Arizona ‘laptop farm’ found that the scheme had infiltrated more than 300 U.S. companies, including an aerospace manufacturer.
As of mid-2026, security researchers assess that North Korean IT-worker operations are using real-time deepfake video during live hiring interviews, potentially defeating conventional liveness detection. A joint alert from 11 nations in July 2026 warned of hiring-interview video feeds that appeared manipulated or artificially generated.
The threat is difficult to address with a single technical control. Microsoft Research said in February that no foolproof method exists for media integrity and authentication, while the European Union’s March 2026 draft Code of Practice similarly proposed layered approaches to marking and labeling AI-generated content rather than relying on one mechanism.
Manufacturing has become a disproportionately attractive target for deepfake-based fraud due to its operational structure. The sector combines high-value, time-pressured payments to unfamiliar or infrequent vendors with complex, opaque multi-tier supply chains where procurement teams prioritize speed over verification. Distributed, remote-first coordination across plants, regional leads, and corporate functions means critical decisions flow through video calls, voice calls, and messaging apps—the exact channels synthetic media exploits. A single fraudulent impersonation can trigger large wire transfers, invoice diversion, or shipment redirection across an ecosystem where visibility into suppliers is limited.
What makes manufacturing uniquely vulnerable now is the collapse of the technical and financial barriers to attack. Remote technical roles such as controls engineers and ERP administrators have expanded manufacturing’s exposure to workforce infiltration by state-sponsored actors seeking internal access for data theft or backdoor installation.
Simultaneously, industrialized attack platforms have commodified deepfake tools, voice cloning, and phishing infrastructure into accessible subscription tiers, with entry costs now measured in dozens of dollars per month rather than nation-state budgets. Producing a convincing video impersonation requires only seconds of voice from a webinar and a reference photo, putting sophisticated social engineering within reach of low-skilled actors.
U.S. government agencies have issued guidance but not sector-specific regulatory frameworks. The NSA, FBI, and CISA jointly released ‘Contextualizing Deepfake Threats to Organizations’ in September 2023, warning critical infrastructure operators about synthetic media threats including fake accounts for social engineering, fraudulent voice and text messages, and deepfake videos for executive impersonation, financial fraud, and unauthorized access. The guidance addresses critical infrastructure generically without enumerating individual sectors; manufacturing-specific targeting evidence instead comes from vendor threat intelligence rather than government advisories.
Federal legislation addressing deepfake disclosure remains fragmented and incomplete. The DEEPFAKES Accountability Act (H.R.5586), introduced in September 2023 to mandate AI-content disclosure and watermarking, died without committee or floor action and has not been reintroduced in the current Congress. The DEFIANCE Act, which passed the Senate in January 2026, provides only a narrower civil remedy for nonconsensual sexual deepfakes and does not apply to executive or vendor impersonation fraud.
Meanwhile, the EU AI Act Article 50, which requires disclosure of AI-generated and manipulated content, took effect on August 2, 2026. In parallel, the DOJ and FBI have pursued multiple prosecutions of DPRK IT-worker infiltration schemes affecting 136+ U.S. companies, and eleven nations have co-signed a joint alert addressing manipulated or AI-generated video in hiring interviews.
CYFIRMA called upon organizations to implement layered verification protocols for all financial transactions and sensitive access requests. Callback verification should use phone numbers from internal records predating the request, never those supplied in the same communication requesting the change. A codeword or challenge-response protocol should be established between finance/procurement staff and executives for authorizing urgent transfers.
Simultaneously, staff should be trained to recognize the fraud pattern itself: any request combining urgency, confidentiality, and a request to bypass normal approval processes should trigger immediate escalation, regardless of how convincing the voice or video appears.
Organizations should harden hiring and interview processes against synthetic media exploitation. Real-time liveness checks should be added to remote interviews by requesting candidates to move their head, hold an object to camera, or answer unscripted questions tied to current events.
The post also called for immediate awareness briefings on real-time deepfake video and voice fraud to be conducted for finance, procurement, and HR teams, as most staff still operate under the assumption that seeing and hearing constitutes proof. Any suspected incidents should be reported to IC3 and the relevant sector ISAC to trigger law enforcement support and contribute to shared threat intelligence.
